i Standard for the Examination of Documents for Alterations 

2 

3 1. Introduction 

4 1.1 An alteration is a revision, modification, or discrepancy within a document. An alteration can be 

5 made to a document by physical, chemical, electronic, or mechanical means. Alterations can generally be 

6 categorized as an addition, deletion, or substitution of information and can be revealed by a variety of 

7 techniques. 

8 1.2 This standard provides the best practices to be used by Forensic Document Examiners (SWGDOC 

9 Standard for Scope of Work of Forensic Document Examiners) for the examination of documents for 
10 alterations. 

11 

12 2. Scope 

13 2. 1 The procedures in this standard are grounded in the generally accepted body of knowledge and 

14 experience within the discipline of forensic document examination. 

15 2.2 The procedures in this standard are applicable whether the examinations are of questioned and 

16 known item(s), or exclusively a questioned item(s). 

17 2.3 The procedures described in this standard are for the purpose of determining the: 

18 2.3.1 Presence of alterations 

19 2.3.2 Method(s) of alteration 

20 2.3.3 Source(s) of a modified document (for example, master document, template, or copy) 

21 2.3.4 Visualization, decipherment, or interpretation of the original information 

22 2.4 Various examinations can be used to aid in the detection of an alteration and to determine the 

23 content of the original information. 

24 2.5 The particular methods used in an examination depend on the nature of the material available for 

25 examination, comparison, and evaluation. 

26 2.6 This standard cannot anticipate all aspects of examinations of unusual substrates or other variables 

27 involved in the creation and handling of the documents prior to submission. 

28 2.7 This standard cannot replace the requisite knowledge, skills, or abilities obtained through 

29 education, training (SWGDOC Standard for Minimum Training Requirements for Forensic Document 

30 Examiners), and experience specific to forensic document examination. 

31 2.8 This standard does not address all safety concerns, if any, associated with its use. The user is 

32 responsible for establishing appropriate health and safety practices prior to use. 
33 

34 3. References 

35 3. 1 ASTM and SWGDOC Standards: 

36 ASTM El 31 Standard Terminology Relating to Molecular Spectroscopy 

37 ASTM E284 Standard Terminology of Appearance 

38 ASTM E1732 Terminology Relating to Forensic Science 

39 SWGDOC Standard for Scope of Work of Forensic Document Examiners 

40 SWGDOC Standard for Test Methods for Forensic Writing Ink Comparison 

41 SWGDOC Terminology Relating to the Examination of Questioned Documents 

42 SWGDOC Standard for Physical Match of Paper Cuts, Tears, and Perforations in Forensic Document 

43 Examinations 

44 SWGDOC Standard for Examination of Handwritten Items 

45 SWGDOC Standard for Indentation Examinations 

46 SWGDOC Standard for Non-destructive Examination of Paper 

47 SWGDOC Standard for Minimum Training Requirements for Forensic Document Examiners 

48 SWGDOC Standard for Examination of Documents Produced with Liquid Ink Jet Technology 

49 SWGDOC Standard for Examination of Documents Produced with Toner Technology 
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50 SWGDOC Standard for Examination of Typewritten Items 

51 SWGDOC Standard for Use of Image Capture and Storage Technology in Forensic Document 

52 Examination 

53 SWGDOC Standard for Examination of Dry Seal Impressions 

54 SWGDOC Standard for Examination of Rubber Stamp Impressions 
55 

56 4. Terminology 

57 4.1 Definitions of Terms Specific to These Procedures: 

58 4.1.1 alteration, n — a change (revision or modification) in a document that occurs by physical, 

59 chemical, electronic, or mechanical means and can include additions, subtractions, or substitutions. 

60 4.1.2 digital image, n — an image that is stored in numerical form. 

61 4.1.3 digital image processing, n — any activity that transforms a digital image. 

62 4.1.4 electrostatic detection device (EDD), n — an instrument that uses electrostatic charge as the 

63 mechanism to visualize paper fiber disturbances (for example, indentations and erasures) (SWGDOC 

64 Standard for Indentation Examinations). 

65 4.1.5 erasure, n — the area where material has been removed from a document by chemical, abrasive, 

66 or other means. 

67 4.1.6 fluorescence, n — a process by which radiant flux of certain wavelengths is absorbed and 

68 reradiated non-thermally at other, usually longer, wavelengths (SWGDOC Standard for Test Methods for 

69 Forensic Writing Ink Comparison, ASTM E284). 

70 4.1.7 infrared (IR), n — referring to radiant flux having wavelengths longer than the wavelengths of 

71 light, usually wavelengths from about 760 nm to about 3 mm (SWGDOC Standard for Test Methods for 

72 Forensic Writing Ink Comparison, ASTM E284). 

73 4.1.8 infrared luminescence (IRL), n — the emission of radiant energy during a transition from an 

74 excited electronic state of an atom, molecule, or ion to a lower electronic state (fluorescence or 

75 phosphorescence, or both), where the spectrum of the excitation source is in the ultraviolet (UV) or 

76 visible region of the electromagnetic spectrum, or both, and the spectrum of the emitted energy is in the 

77 far red or infrared (IR) region of the electromagnetic spectrum (SWGDOC Standard for Test Methods for 

78 Forensic Writing Ink Comparison). 

79 4.1.9 infrared reflectance (IRR), n — non-absorbed radiant infrared (or far red) energy. 

80 4.1.10 light, n — electromagnetic radiant energy that is visually detectable by the normal human 

81 observer: radiant energy having wavelengths from about 380 to about 760 nm (SWGDOC Standard for 

82 Test Methods for Forensic Writing Ink Comparison, ASTM E284). 

83 4. 1 . 1 1 luminescence, n — the emission of radiant energy during a transition from an excited electronic 

84 state of an atom, molecule, or ion to a lower electronic state (SWGDOC Standard for Test Methods for 

85 Forensic Writing Ink Comparison, ASTM E131). 

86 4.1.12 magnetic properties detector, n — a device used to detect or measure magnetic properties in ink 

87 and toner. 

88 4.1.13 side lighting, n — illumination from a light source that is at a low angle of incidence, or even 

89 parallel, to the surface of the item. Syn., oblique lighting, grazing illumination. 

90 4.1.14 transmitted light, n — illumination that passes through a substrate. 

91 4.1.15 ultraviolet (UV), n — referring to radiant flux having wavelengths shorter than the wavelengths 

92 of light, usually wavelengths from about 10 to 380 nm. Long-wave UV usually refers to the spectral range 

93 of UV-A, with wavelengths from about 315 to 380 nm. Mid- wave UV usually refers to the spectral range 

94 of UV-B, with wavelengths from about 280 to 315 nm. Short-wave UV usually refers to the spectral 

95 range of UV-C, with wavelengths from about 100 to 280 nm (SWGDOC Standard for Test Methods for 

96 Forensic Writing Ink Comparison). 
97 

98 5. Limitations 

99 5.1 Items submitted for examination can have limitations that interfere with the procedures in this 
100 standard. Limitations can be due to the submission of non-original documents; the condition, quantity, or 
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101 comparability of the material submitted; or from limited individualizing characteristics. Note and 

102 document limitations. 

103 5.2 Document examinations should be conducted prior to any destructive processing. Items should be 

104 handled appropriately to avoid compromising subsequent examinations. Prior storage conditions, 

105 handling, testing, or destructive processing can interfere with the examination. 

106 5.3 Care shall be taken in the evaluation of characteristics indicative of alteration as they might have 

107 occurred during normal preparation, handling, and storage of the document. 

108 5.4 Some alterations might not have observable physical characteristics or be detectable based on the 

109 type of examination(s) suggested in this standard. The absence of observable physical characteristics does 

110 not ensure the absence of an alteration. 
Ill 

112 6. Equipment 

113 6.1 Appropriate light source(s) to distinguish fine detail. Natural, incandescent, fluorescent, light 

114 emitting diode (LED), or fiber optic lighting sources are generally used. Transmitted, side, and vertical 

115 incident lighting are useful techniques. Focusable light sources are particularly helpful. 

116 6.2 Optical magnification to resolve fine detail. 

117 6.2. 1 The best practice is to utilize an optical device having a minimum of 4x magnification. 

118 6.2.2 A reducing lens can be useful in deciphering faint material, such as faded or erased writing. 

119 6.3 Image capture device(s) capable of producing true and accurate images with sufficient resolution 

120 to record significant detail. 

121 6.4 Infrared (IR) image conversion device or system with appropriate light sources and filters for use 

122 in infrared reflectance (IRR) and infrared luminescence (IRL) examinations. 

123 6.5 Long-wave, mid-wave, and short-wave ultraviolet (UV) sources. 

124 6.6 Measuring devices as needed, such as a paper micrometer, alignment grids, rulers, magnifier(s) 

125 with reticule(s), and measuring software. 

126 6.7 Electrostatic detection device (EDD) (SWGDOC Standard for Indentation Examinations). 

127 6.8 Magnetic properties detector. 

128 6.9 Software for digital image processing as needed. 

129 6.10 Time and facilities necessary to complete all applicable procedures. 

130 6. 1 1 Other equipment used for validated procedures that can be relevant to the examination of 

131 documents for alterations, as deemed appropriate by the examiner, (for example, radiography system or 
X-rays— r 

134 7. Procedures 

135 7.1 Perform applicable procedures and contemporaneously document the examinations performed and 

136 relevant observations. The results and accompanying notes should have sufficient detail to allow for an 

137 independent review and assessment of the conclusions by a Forensic Document Examiner. Include all 

138 relevant facts, equipment used, methods, evaluations, as well as any conclusions, opinions, or 

139 interpretations. 

140 7.2 These procedures do not have to be performed in the order given. It is within the discretion of the 

141 examiner to discontinue the procedure at any point during the examination. Document the reason(s) for 

142 such a decision. 

143 7.3 Material(s) removed from the item under examination might be of evidentiary value and should 

144 be documented prior to removal and preserved separately for subsequent examination(s). These materials 

145 can include staples, other binding devices or attached documents, and trace materials. 

146 7.4 The procedures in this standard can require significant changes to an item in order to facilitate the 

147 examination process. Prior to making any permanent changes to an item, obtain and document permission 

148 from the responsible party involved in the examination request. This may entail discussions with 

149 investigators, owners, and attorneys. 
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150 7.4.1 It is best practice that the responsible party requesting the examination be informed as to 

151 potential benefits of these changes and the extent of possible physical changes to the document. The 

152 responsible party should inform attorneys or other interested parties. 

153 7.4.2 It is also best practice to capture images of the item before and after making significant changes. 

154 7.5 The examination of the original item(s) is always preferable. Request the original item(s) if not 

155 previously submitted. 

156 7.5.1 If the original item(s) is not available for examination, assess the quality of the best available 

157 copy. 

158 7.5.2 If the significant details have been reproduced with sufficient clarity for examination purposes, 

159 continue with the applicable procedures to the extent possible. 

160 7.6 Conduct an initial assessment of the document to determine the appropriate examinations, 

161 sequence of examinations, and potential limiting factors. 

162 7.7 The examination of a document can include the following: 

163 7.7.1 Handwriting (SWGDOC Standard for Examination of Handwritten Items) 

164 7.7.1.1 Overwriting or obliteration of entries 

165 7.7.1.2 Crowded or awkward spacing of writing 

166 7.7.1.3 Inconsistent handwriting features (evidence of multiple authorship) 

167 7.7.1.4 Characteristics of the writing media, such as variation in color and intensity or class of writing 

168 instrument 

169 7.7.2 Printing processes and defects (SWGDOC Standard for Examination of Documents Produced 

170 with Liquid Ink Jet Technology, SWGDOC Standard for Examination of Documents Produced with 

171 Toner Technology, and SWGDOC Standard for Examination of Typewritten Items) 

172 7.7.2. 1 Variation in printing processes 

173 7.7.2.1.2 Type of printing process 

174 7.7.2.1.3 Color or intensity of printing media 

175 7.7.2.1.4 Physical characteristics of the print media, such as the morphology, magnetic, infrared, and 

176 ultraviolet properties 

177 7.7.2.2 Use of different fonts, sizes, styles, spacing, and margins 

178 7.7.2.3 Crowded or awkward placement of printed text, such as irregular vertical and/or horizontal 

179 alignment 

180 7.7.2.4 Different individualizing characteristics, such as artifacts and misspellings 

181 7.7.3 Paper or substrate characteristics (SWGDOC Standard for Non-destructive Examination of 

182 Paper) 

183 7.7.3.1 Area(s) of discoloration or other physical changes to the optical properties of the substrate (for 

184 example, abrasions, fiber disturbance, changes to the optical properties, damage to the security laminate) 

185 7.7.3.2 Paper fiber or substrate disturbance 

186 7.7.3.3 Variation in paper or substrate characteristics, such as, thickness, length, width, opacity, 

187 guillotine marks, watermarks, and UV fluorescence 

188 7.7.3.4 Paper cuts, tears, perforations, and folds (SWGDOC Standard for Physical Match of Paper 

189 Cuts, Tears, and Perforations in Forensic Document Examinations) 

190 7.7.3.5 Indentations (SWGDOC Standard for Indentation Examinations) 

191 7.7.4 Fastening or binding characteristics 

192 7.7.4.1 Inconsistent or multiple binding methods 

193 7.7.4.2 Presence, absence, or removal of adhesives 

194 7.7.4.3 Presence, alignment, and number of staples and staple holes, hole punches and perforation 

195 patterns 

196 7.7.4.4 The makeup, condition, placement, and effect of paper clips on a document 

197 7.7.4.5 Presence or absence of expected markings 

198 7.7.5 Miscellaneous characteristics 

199 7.7.5.1 Presence of an obscuring substance 

200 7.7.5.2 Smearing of printing/writing media 
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201 7.7.5.3 Sequence of line intersections, such as those involving writing media, mechanical 

202 impressions, folds, printed text, and other anomalies (SWGDOC Standard for Examination of Dry 

203 Seal Impressions and SWGDOC Standard for Examination of Rubber Stamp Impressions) 
204 

205 7.7.5.4 Cutting and pasting or substitution(s) 

206 7.7.5.5 Insertion(s) or omission(s) of page(s) or entries 

207 7.8 Subsequent to the completion of the initial assessment proceed to the applicable examinations. 
208 

209 NON-DESTRUCTIVE EXAMINATIONS 

210 7.9 9 Non-destructive examinations are those that do not damage or otherwise change the document. 

211 Non-destructive procedures shall be performed when applicable and need not be performed in the order 

212 given. 

213 7.9.1 Visually examine both sides of the document macroscopically and microscopically. 

214 7.9.2 Make appropriate observations, measurements, or both, to include: 

215 7.9.2. 1 Paper or substrate (SWGDOC Standard for Non-destructive Examination of Paper and 

216 SWGDOC Standard for Physical Match of Paper Cuts, Tears, and Perforations in Forensic Document 

217 Examinations) 

218 7.9.2.2 Letter, word, line, and margin spacing 

219 7.9.2.3 Color 

220 7.9.2.4 Fastening and binding marks 

221 7.9.2.5 Facsimile transmitted terminal identifiers (TTI) 

222 7.9.2.6 Trash, roller, and picker bar marks 

223 7.9.3 Examine the document using various optical techniques and light sources, such as side lighting, 

224 transmitted lighting, UV, IRR, and IRL (SWGDOC Standard for Indentation Examinations and 

225 SWGDOC Standard for Test Methods for Forensic Writing Ink Comparison). 

226 7.9.4 Examine the document with imaging techniques, such as photography or digital image 

227 processing (SWGDOC Standard for Use of Image Capture and Storage Technology in Forensic 

228 Document Examination). 

229 7.9.5 Process the document using an EDD (SWGDOC Standard for Indentation Examinations). 

230 7.9.6 Examine the print media with a magnetic properties detector. 

231 7.9.7 Decipher and document visualized entries. 

232 7.10 Analyze and compare the observed features and characteristics of the document to known items 

233 (if available), and evaluate the findings. 

234 7. 1 1 Form a conclusion based on the results of the above examinations, comparisons, and evaluations 

235 and report accordingly. 

236 7.12 Proceed to destructive examinations, if they be deemed necessary by the examiner. 

238 DESTRUCTIVE EXAMINATIONS 

239 7.13 Destructive examinations are those that damage or otherwise change the document. They should 

240 be performed only after non-destructive methods have been conducted. 

241 7.13.1 Prior to making any permanent changes to an item, obtain and document permission from the 

242 responsible party involved in the examination request. This may entail discussions with investigators, 

243 owners, and attorneys. 

244 7.13.1.1 It is best practice that the responsible party requesting the examination be informed as to 

245 potential benefits of these examinations and the extent of possible physical changes to the document. The 

246 responsible party should inform attorneys or other interested parties. 

247 7.13.2 The use of destructive examinations can interfere with other types of forensic examinations 

248 (for example, chemical analysis of ink or latent print examinations). 

249 7.13.3 Prior to using these techniques, the physical condition or appearance of the item(s) shall be 

250 documented. 
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251 7.13.4 Consideration should be given to the order in which destructive examinations are performed. 

252 7.14 When an obscuring substance is present, the obscured information can be visualized by several 

253 destructive methods. 

254 7.14.1 When using solvents or physical removal techniques, testing should be performed prior to 

255 general application to each item in order to determine the best course of action. 

256 7. 14. 1 . 1 It is best practice that initial testing be performed on items not related to the matter that are 

257 made of similar materials. Adapt and adjust materials and techniques as required prior to application to 

258 the item submitted for examination. 

259 7.14.2 Apply a solvent or other visualization substance to make the paper translucent for visualization 

260 of the obscured entry. Document visualized entry. 

261 7.14.3 Apply a solvent capable of removing the obscuring substance. 

262 7.14.3.1 Exposure to solvents, in an attempt to remove the obscuring substance, can have a 

263 deleterious effect on inks, toner, or substrate. 

264 7.14.4 Physically remove (for example, abrade, scrape, lift, or peel) the obscuring substance from the 

265 entry. 

266 7.14.5 Entries physically obscured by synthetic or biological substances (such as blood, grease, tape, 

267 or gum) can be recovered by removal of the substance after freezing. 

268 7. 15 For chemical ink examinations refer to SWGDOC Standard for Test Methods for Forensic 

269 Writing Ink Comparison. 

270 7.16 Analyze and compare the observed features and characteristics of the document to known items 

271 (if available), and evaluate the findings. 

272 7.17 Form a conclusion based on the results of the above examinations, comparisons, and evaluations 

273 and report accordingly. 

274 7.18 Conduct other forensic document examinations as appropriate. 
275 

276 8. Reporting 

277 8.1 Reports generated as the result of the procedures used in this standard should be complete and 

278 thorough. The report should contain examinations conducted, results, conclusions or opinions, and as 

279 appropriate, sources of uncertainty. 

280 8.2 The report should also include the stated purpose or reason for conducting the examination, 

281 observations, limitations, and the bases and reasons for the conclusions or opinions being reported. 

282 8.3 The conclusions or opinions resulting from the procedures in this standard may be reached after 

283 an examination has been conducted. The number and nature of examinations are dependent on the 

284 material being evaluated. 

285 8.4 The conclusions or opinions in the report may also address: 

286 8.4.1 Whether or not characteristics indicative of alterations were observed 

287 8.4.2 Whether or not any altered entries were decipherable 

288 8.4.3 The text or description of altered and original entries 

289 8.4.4 Method or sequence of alterations 

290 8.4.5 Images of alterations and original entries 

291 8.4.6 Apparent alterations in documents that can be the result of software, hardware or user caused 

292 variations and can occur during normal or legitimate document production 
293 
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